you've no tests checking for an invalid password